NIST NVD CVEs — Every Vulnerability Published Since 2020 With CVSS V3 Score, Severity And Vector, CWE Ids And Description

DatasetCSV.GZOpenCybersecurityVulnerabilitiesCveCvssNvdNistFree

250,910 CVE records published between 1 January 2020 and 2026-09-06 in the National Vulnerability Database: CVE id, publication and last-modified timestamps, NVD status, the CVSS v3.x base score, severity and vector string (232,487 scored; v3.1 preferred over v3.0 and NVD's own metric over a CNA's), CWE weakness ids, the English description capped at 1,000 characters and the number of references, one row per CVE. 10,662 rejected CVEs are kept with status Rejected and blank metrics. From the NVD CVE API 2.0 as of 2026-09-06.

Use Cases

Vulnerability-disclosure trend and severity-mix analysis
Training and evaluation data for security text classification
CWE weakness-class statistics by year
Enriching software bills of materials and patch backlogs

Methodology

CVE API 2.0 crawled in consecutive 120-day pubStartDate/pubEndDate windows from 2020-01-01 at 2,000 results a page, one request every 6.1 s (0.7 s with NVD_API_KEY), 403/429/5xx retried after 30 s; CVSS v3 fields from the v3.1 metric when present, else v3.0, preferring the entry typed Primary; CWE ids from the English weakness entries joined with semicolons; descriptions collapsed to one line and truncated to 1,000 characters; de-duplicated on CVE id; sorted by publication timestamp.

Update Schedule

Static snapshot. NVD publishes and re-scores CVEs continuously; refresh monthly.

Attribution

Source: National Institute of Standards and Technology, National Vulnerability Database (nvd.nist.gov), CVE API 2.0; US government work, public domain. CVE Record Information is used under the CVE Program's Terms of Use, which permit reproduction and distribution with attribution.

Schema

name	type
cve_id	string
published	date
last_modified	date
vuln_status	string
cvss_v3_base_score	number
cvss_v3_severity	string
cvss_v3_vector	string
cwe_ids	string
description_en	string
reference_count	integer

Sample Data

cve_id	cwe_ids	published	vuln_status	last_modified	cvss_v3_vector	description_en	reference_count	cvss_v3_severity	cvss_v3_base_score
CVE-2019-20203	CWE-290	2020-01-02T14:16:35.987	Modified	2026-06-17T02:30:11.817	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.	8	MEDIUM	5.3
CVE-2019-20204	CWE-79	2020-01-02T14:16:36.160	Modified	2026-06-17T02:30:11.930	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.	10	MEDIUM	5.4
CVE-2019-20205	CWE-190	2020-01-02T14:16:36.253	Modified	2026-06-17T02:30:12.043	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.	2	HIGH	8.8
CVE-2019-20208	CWE-787	2020-01-02T14:16:36.363	Analyzed	2026-06-17T02:30:12.157	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	dimC_Read in isomedia/box_code_3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow.	6	MEDIUM	5.5
CVE-2019-20213	CWE-74;CWE-863	2020-01-02T14:16:36.533	Modified	2026-06-17T02:30:12.807	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.	8	HIGH	7.5

Get this via API

# 1. Add dAgentBase once, in any MCP client. No install, no vendor keys.
#    Claude.ai / Claude Desktop: Settings -> Connectors -> Add custom connector
#    Cursor / Claude Code / others: mcp.json
{
  "mcpServers": {
    "dagentbase": {
      "url": "https://dagentbase.com/api/mcp",
      "headers": { "Authorization": "Bearer dm_live_YOUR_KEY" }
    }
  }
}

# 2. Then ask your agent, in plain language:
#    "Preview 'NIST NVD CVEs — Every Vulnerability Published since 2020 with CVSS v3 Score, Severity and Vector, CWE Ids and Description' and, if it fits, claim it and download the files."
#    Tools it will use: search_listings -> preview_listing -> purchase_listing -> get_download_urls

# 1. Add dAgentBase once, in any MCP client. No install, no vendor keys.
#    Claude.ai / Claude Desktop: Settings -> Connectors -> Add custom connector
#    Cursor / Claude Code / others: mcp.json
{
  "mcpServers": {
    "dagentbase": {
      "url": "https://dagentbase.com/api/mcp",
      "headers": { "Authorization": "Bearer dm_live_YOUR_KEY" }
    }
  }
}

# 2. Then ask your agent, in plain language:
#    "Preview 'NIST NVD CVEs — Every Vulnerability Published since 2020 with CVSS v3 Score, Severity and Vector, CWE Ids and Description' and, if it fits, claim it and download the files."
#    Tools it will use: search_listings -> preview_listing -> purchase_listing -> get_download_urls

Free

one time · open license

Details

Date Range2020-01-02 — 2026-09-06

Rows250,910

Size25.9 MB

Files1

FormatCSV.GZ

Available formats

CSV.GZ25.9 MB

Freeopen